AMD, Advanced Micro Devices Inc., outlined two new attacks that allow bypassing its Secure Encrypted Virtualization (SEV) protection technology.
The US chipmaker has issued guidance for two attacks it tracks as CVE-2020-12967 and CVE-2021-26311. The vulnerabilities were described in two research papers titled “SEVerity: Code Injection Attacks against Encrypted Virtual Machines” and “undeSErVed trust: Exploiting Permutation-Agnostic Remote Attestation” The two research teams that wrote the papers will present their findings at the 15th IEEE Workshop on Offensive Technologies (WOOT’21) this year.
AMD Secure Encrypted Virtualization (SEV) is designed to protect virtual machines and the hypervisor. Researchers showed how threat actors can circumvent SEV protection mechanisms to inject arbitrary code into the virtual machine.
The first flaw – CVE-2020-12967 – was detected by Mathias Morbitzer, Martin Radev, and Erick Quintanar Salas from Fraunhofer AISEC and Sergej Proskurin and Marko Dorfhuber from the Technical University of Munich. It stems from the lack of nested page table protection in the AMD SEV/SEV-ES feature. By exploiting the bug, attackers could execute arbitrary code on the guest VM. For this, an attacker must obtain an administrator’s access and compromise the server hypervisor.
The second vulnerability – CVE-2021-26311 – Luca Wilke, Jan Wichelmann, Florian Sieck, and Thomas Eisenbarth from the University of Lübeck. It resides in the AMD SEV/SEV-ES feature, too, and a malicious administrator needs to have access to compromise the server hypervisor. According to the security advisory, an attacker can rearrange the memory in the guest address space which can potentially lead to arbitrary code execution within the guest VM.
The vulnerabilities impact all AMD EPYC processors, AMD EPYC™ Embedded Processors, and 1st/2nd/3rd Gen AMD EPYC™ Processors.
The vendor has provided mitigation in the SEV-SNP feature for 3rd Gen AMD EPYC™ processors, so customers using 3rd Gen AMD EPYC™ are advised to mitigate the attacks by turning on SEV-SNP.
Customers with prior generation processors not supporting SEV-SNP should follow security best practices provided by AMD.
